feat(wasm): org_unwrap_key — ECIES unwrap into a session handle

Expose org_unwrap_key(keys_blob, device_private_openssh) to let the
extension SW unwrap a member's ECIES-wrapped org master key into an
ordinary Zeroizing session handle. The returned handle is key-agnostic
and works with the existing item_decrypt/manifest_decrypt AEAD.

Key-form finding: device private keys are OpenSSH PEM blobs produced by
relicario_core::device::generate_keypair(), not base64 raw bytes. The
plan's "device_private_key_base64" parameter name was misleading; all
code and the .d.ts declaration use "device_private_openssh" to match
the spec and reality.

Adds ssh-key dep to relicario-wasm for PEM parsing in decode_device_seed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014s527M917W47LDrfQ4t47g

extension/src/wasm.d.ts

@@ -87,6 +87,8 @@ declare module 'relicario-wasm' {
   export function wasm_generate_recovery_qr(handle: SessionHandle, passphrase: string): string;
   export function wasm_unwrap_recovery_qr(payload_b64: string, passphrase: string): Uint8Array;
 
+  export function org_unwrap_key(keys_blob: Uint8Array, device_private_openssh: string): SessionHandle;
+
   export default function init(module_or_path?: unknown): Promise<void>;
   export function initSync(args: { module: WebAssembly.Module }): void;
 }